Japanese IT Provider GMO Requests Active Cyber Defense Support Following System Intrusion

Measured in the raw computing power of 26,739 compromised virtual servers, the breach at Japanese IT provider GMO Internet Group is substantial. But the true magnitude lies in what those servers were doing: running automated foreign exchange trading tools around the clock for retail investors.[2][3]

Following the intrusion, GMO formally asked the Japanese government to deploy its newly enacted "active cyber defense" powers to neutralize the attackers. The emergency request, made on October 24, marks the first public appeal for state intervention under a law that took effect just three weeks earlier.[1][2]

The attackers breached GMO's Onamae.com Desktop Cloud, a service catering to traders using MT4 and MT5 platforms. By planting malicious software on the virtual machines, the intruders gained access to trading logins and began executing unauthorized trades across more than 70 different securities firms.[2]

The attackers did not simply steal data; they actively manipulated the financial markets using the victims' own capital. By hijacking the automated trading sessions, the intruders bypassed traditional two-factor authentication measures that usually protect retail brokerage accounts from direct external access.[2]

The timeline of the intrusion reveals a rapid escalation by the threat actors. GMO first received inquiries from users regarding suspicious account activity, and internal investigators quickly confirmed that unauthorized programs had been installed on the host servers.[1][2]

The Ransom and Response

By October 21, the company initiated a sequential shutdown of all server plans to halt the unauthorized trading. The attackers then pivoted their strategy, issuing a ransom demand and threatening to weaponize the stolen customer data if their financial terms were not met.[1][2][3]

GMO publicly refused the ransom demand, stating that paying would not guarantee the data's deletion or prevent its future misuse. The company has asked major exchanges to block access from the compromised service and terminate all active trading sessions immediately.[1][2]

In addition to the government appeal, GMO has formally asked the police to open a criminal investigation into the intrusion. The company also warned its users and the public that any data or claims published by the attackers in the future may be partially fabricated to maximize extortion leverage.[2]

The ripple effects are already visible across the Japanese financial sector. On October 22, OANDA Japan informed its customers that MT4 and MT5 logins used on the GMO service may have been exposed, prompting the broker to briefly suspend withdrawals while conducting emergency security audits.[2]

Japan's active cyber defense framework, which went live on October 1, represents a historic shift from the country's traditionally passive security posture. The legislation authorizes the Self-Defense Forces and police to pre-emptively infiltrate and disable hostile servers before widespread damage occurs.[1][2][3]

Testing the New Defense Law

However, the legislation was designed primarily to protect designated critical infrastructure operators, a classification that GMO Internet Group does not currently hold. This makes the company's emergency request an unprecedented test of the government's willingness to extend state cyber capabilities to private enterprise.[2]

"Defense measures and responses by private business operators alone can hardly eradicate highly skilled cybercrime organizations that steal people's assets," GMO stated in its urgent appeal. The company argues that reactive corporate security is no longer sufficient against modern, well-resourced threat actors.[1][3]

While the concept of "hacking back" sounds decisive in policy briefings, the technical reality of active defense is far more complex. Tracing an attack through obfuscated proxy chains to a definitive source requires immense intelligence resources that most civilian agencies lack.[2]

Furthermore, neutralizing a single server often just forces the attackers to shift to backup infrastructure without dismantling the underlying criminal organization. Security vendors frequently market active defense as a silver bullet, but the operational mechanics involve significant geopolitical and legal risks.[2]

Infiltrating a server located in a foreign jurisdiction without international coordination can easily escalate into a diplomatic incident. If the Japanese government acts on GMO's request, it must navigate the murky legal waters of cross-border digital sovereignty while attempting to recover the stolen data.[1][2]

Fallout and Financial Compensation

In the wake of the breach, GMO announced it will compensate users for realized financial losses resulting from the unauthorized trades. The reimbursement will cover direct trading losses and fees, minus any refunds provided directly by the affected brokerages.[1][2][3]

The company is also issuing a flat ¥5,000 (about $32) goodwill payment to every current customer of the Onamae.com Desktop Cloud service, regardless of whether their accounts were manipulated. The service itself will not return, permanently altering the landscape for retail automated trading in Japan.[1][2][3]

The breach highlights the compounding risks of centralized cloud infrastructure hosting sensitive financial credentials. When retail traders outsource their automated strategies to a single virtual environment, a single point of failure can compromise accounts across dozens of independent brokerages simultaneously.[2]

The Japanese government now faces a delicate policy decision regarding the scope of its new cybersecurity mandate. Approving GMO's request could set a precedent for state intervention in private-sector breaches, effectively turning the Self-Defense Forces into a retaliatory arm for corporate Japan.[1][2]

Conversely, denying the request might signal to cybercrime syndicates that non-critical infrastructure remains a safe and lucrative target. As the October 1 law faces its first real-world trial, the outcome will likely define the boundaries of Japan's new proactive cyber doctrine.[1][2]